Cloudflare Analytics: understand visitors, requests and cache hit ratio

How to read four Cloudflare metrics together

Consider a generic example: a few hundred unique visitors, a few thousand requests, tens of megabytes served and a single-digit cached percentage. These are useful signals, but they do not reveal how many people read a page. Cloudflare observes HTTP traffic crossing its network for proxied DNS records, so it measures an infrastructure layer that comes before browser analytics. Requests may originate from people, crawlers, bots, automated checks or external services.

The four values describe different dimensions. Unique visitors approximate traffic sources; requests count individual HTTP operations; data served adds up response volume; the cached percentage indicates how much activity was delivered from the edge in the selected view. Before judging a spike or a low percentage, confirm the time range, hostname, filters, Cloudflare plan and whether the chart is based on requests or data transfer.

Unique visitors are IP addresses, not identified people

Why one unique visitor does not equal one reader

Cloudflare explains that it identifies a visit when it recognizes a unique IP address for a request. This is a technical estimate, not a count of human beings, authenticated users or sessions. Several people on a home, company or mobile network may share one IP, while one person may appear more than once after changing network or address. Crawlers and partial-content requests can also contribute without producing a complete page view.

The number remains valuable for trends, anomalies and traffic distribution when comparisons retain the same window and filters. A sudden increase might be genuine attention, automated scanning, a campaign, social link previews or hostile traffic. Segment by path, country, user agent, security action and HTTP status before choosing an explanation. The total number of IP addresses alone is not evidence of commercial acquisition.

Why requests greatly outnumber visitors

A request is one HTTP operation. Loading a page may require HTML, style sheets, JavaScript, images, fonts, API calls and redirects, so it creates multiple requests. When a few hundred IP addresses generate several thousand requests, the resulting ratio is not an engagement metric: assets already stored in the browser, bots downloading one file, failures, prefetching and the site architecture can all change it dramatically.

Data transfer, cache ratio and cache statuses

The displayed volume represents HTTP data transferred in responses observed by Cloudflare, not the size of the website and not necessarily the traffic billed by Vercel. Dividing rounded totals would only produce a rough average per request, mixing HTML, images, errors and responses without a body. Filtering by content type and URL is more useful because it reveals large, frequently requested objects that still reach the origin.

Request hit ratio and byte hit ratio answer different questions

The share of requests served from cache measures how many operations avoid the origin; the share of data served from cache measures how many bytes the edge delivers. A site can have a low request hit ratio yet save substantial bandwidth when large images are cached. The reverse can happen when many tiny assets are HIT while large responses stay dynamic. In Cache Analytics, a revalidated response can count as origin-served in the Requests view but Cloudflare-served in Data Transfer because the origin is contacted while the body remains cached.

A HIT generally means a response was available in cache; a MISS requires retrieval from the origin; BYPASS reflects a rule or signal that skips cache; DYNAMIC marks content considered ineligible; and REVALIDATED involves a freshness check. The distribution by status, path and content type is more informative than a single-digit percentage alone. It distinguishes legitimate dynamic HTML from poorly configured assets or responses that cannot be reused.

Separate human traffic, bots and threats

The Zone Analytics documentation says that on the free plan the HTTP Traffic panel includes legitimate requests together with crawlers and threats. Cloudflare works at the edge and sees clients that never execute JavaScript. Its unique visitor count can therefore exceed users and sessions in browser-based products. A search engine crawler, uptime monitor, link-preview service or scanner creates real infrastructure traffic without necessarily representing a prospect.

Estimate interested people by combining successful HTML page views, referers, visited paths, known sources, conversion events and available bot filters. Also inspect spikes in 403, 404 and 5xx responses, unusual methods and unexpected countries. Do not discard all automation: search crawlers support discoverability and monitors protect availability. The goal is to match each metric to the right question, not make every dashboard display the same total.

Cloudflare, Web Analytics, GA4 and PostHog measure different layers

Zone Analytics describes HTTP traffic seen by the network. Cloudflare Web Analytics adds page-level and real-browser performance signals. GA4 models users, sessions, acquisition channels and marketing events, while PostHog is well suited to product events, funnels and user journeys. Browser tools depend on script loading, consent, blockers, completed navigation and implementation quality. Cloudflare can see a request even when someone leaves before analytics code starts.

For a useful reconciliation, align the period, time zone, hostnames and environments, then compare compatible measures: successful HTML page views with views, conversions with confirmed events, and edge requests with technical logs. Expecting unique IPs to equal GA4 or PostHog users creates false alarms. A practical hierarchy uses Cloudflare for volume and security, Web Analytics for page experience, GA4 for acquisition and PostHog for behavior, with a server-side source for critical conversions.

Why a low cache ratio is not automatically an error

A low ratio can be correct when requests mostly concern personalized HTML, APIs, previews, authentication or responses with cookies and private directives. MDN warns that personalized content must not enter a shared cache because another user could receive it. Errors, redirects, highly variable query strings and non-GET requests may also lower the ratio. Optimization means caching only responses that are public, stable and reusable, rather than pursuing a universal target.

With Vercel behind Cloudflare, two CDN layers are involved. A Cloudflare MISS that reaches the configured origin may still be served by Vercel’s edge cache, so the Cloudflare panel alone cannot reveal function or application-server load. Inspect CF-Cache-Status and x-vercel-cache together with Cache-Control, CDN-Cache-Control and Vercel-CDN-Cache-Control. These headers can target different recipients and TTLs, while overlapping policies make invalidation and troubleshooting harder.

Run a safe audit before changing Cache Rules

Start with a representative week and classify URLs as versioned assets, public pages, dynamic HTML, public APIs or private responses. For each group, measure requests, bytes, cache status, HTTP status and origin time. Review the top MISS URLs, inspect headers across repeated requests and test behavior after deployments and purges. Prioritize heavy, frequent public assets while excluding login, admin, session cookies and personalized data.

• Compare the request ratio and byte ratio instead of treating them as one metric.
• Define cache keys and TTLs by path and content rather than through one global rule.
• Test query strings, cookies, authorization, language and variants before rollout.
• Observe both Cloudflare and Vercel, and document which layer owns each response.
• Monitor 4xx, 5xx, freshness and conversions alongside cache improvements.

A blanket “cache everything” rule without an inventory can serve stale or private data and hide failures. Roll out small URL groups with a rollback path, then verify from both browser and origin. Our infrastructure, analytics and performance services help create a reliable measurement model; for a focused Cloudflare and Vercel configuration audit, contact AE Digital Agency.